It has been a long time coming. On November 2, 2020, the Drug Enforcement Administration (DEA) released its long-awaited proposed rule to revise the regulations related to suspicious orders of controlled substances. The proposed rule will implement the Preventing Drug Diversion Act of 2018 (PDDA) and clarify the procedures a registrant must follow for orders received under suspicious circumstances, referred to as “ORUSCs.” There are four key regulatory changes being proposed by DEA: (1) new definitions, (2) expansion of the types of registrants required to report, (3) procedures for identifying and reporting suspicious orders, and (4) reporting and recordkeeping requirements.

Key to the proposed rule is the establishment of a “two-option framework” for registrants to deal with ORUSCs: namely, they could (1) decline to ship the ORUSC and immediately file a suspicious order report to DEA’s centralized database, or (2) conduct due diligence into the ORUSC and make a determination about the order’s validity within seven calendar days, among other requirements. DEA is accepting electronic and written comments on the proposed rule through January 4, 2021.

Background on Suspicious-Order Requirements

Since the Controlled Substance Act (CSA) became law in 1970, DEA registrants who distribute controlled substances have been required to maintain effective controls against diversion. In addition, the first regulations implementing the CSA contained provisions regarding suspicious orders of controlled substances. Currently, registrants must design and operate a system to disclose suspicious orders of controlled substances to the agency, although this highly decentralized system has been fraught with inconsistencies throughout the industry. The lack of DEA guidance regarding how to identify and designate a controlled substance suspicious order made matters even more challenging, and has vexed most stakeholders for years. For example, in 2018, we wrote about congressional hearings in which wholesale distributor industry representatives were grilled on their processes for flagging, reviewing, and reporting suspicious orders from pharmacies located in regions of the country hard-hit by the opioid epidemic.

In the paramount Masters[1] case, the United States Court of Appeals for the District of Columbia Circuit held that distributors have two choices: (1) decline to ship the order, without need to conduct additional due diligence, or (2) conduct due diligence to determine whether the order is suspicious. 

Subsequently, Congress enacted the PDDA, which was contained within the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), in order to address some of the problems with identifying and reporting of suspicious orders. The PDDA required DEA to establish a centralized database for collecting reports of suspicious orders. Additionally, it defined “suspicious orders” as orders, or a “series of orders,” of unusual size, pattern, or frequency.

DEA’s Proposed Rule

Scope

The proposed rule applies to not only registered wholesale distributors, but also to manufacturers, importers, practitioners, and Narcotic Treatment Programs (NTPs) that distribute controlled substances.

Definitions

DEA is proposing to incorporate the PDDA’s definition of “suspicious order” into its regulations. It also expands upon the statute by defining “order,” which is tentatively defined as:

“any communication by a person to a registrant proposing or requesting a distribution of a controlled substances, regardless of how it is labeled by the person or the registrant, and regardless of whether a distribution is made by the registrant, except that simple price/availability inquiries, standing alone, do not constitute an order.”

The proposed rule also provides a definition for “due diligence” with respect to the steps a registrant must take when reviewing an ORUSC and determining that it is okay to ship. The proposed definition of due diligence consists of:

“a reasonable and documented investigation into persons and orders (coupled with other appropriate investigations, including previous investigations into persons and orders) that includes, but is not limited to, verification that a person (or a person submitting an order) holds the appropriate DEA registration, verification that a person (or a person submitting an order) holds all licenses required by the state(s) in which a person (or a person submitting an order) conducts business with respect to controlled substances, examination of each suspicious circumstance surrounding an order, and examination of all facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.”

DEA states that these newly proposed definitions are consistent with current understanding of the terms and likely will have little impact on how registrants conduct business.

Two-Option Framework

One of the most prominent regulatory changes that would be implemented if the proposal is finalized as currently written is the “two-option framework” for dealing with orders received under suspicious circumstances. DEA is proposing that, upon receipt of an ORUSC, registrants authorized to distribute controlled substances will have two options (hence its use of the term “two-option framework”):

1. Immediately file a suspicious order report through the DEA centralized database, decline to distribute the controlled substances requested in the suspicious order, and maintain a record of the suspicious order and any due diligence related to the suspicious order, or

2. Before distributing any controlled substances pursuant to the order, conduct due diligence to investigate each suspicious circumstance surrounding the ORUSC, and maintain a record of the registrant’s due diligence regarding the ORUSC.

Under the second option, if the registrant is able to dispel each suspicious circumstance within seven calendar days after receipt of the order, it will no longer be considered a suspicious order. Thus, such an order would not need to be reported to DEA as a suspicious order. If no determination is made within the seven calendar-day timeframe, the registrant must report the undetermined order as a suspicious order and submit it to the DEA centralized database. According to DEA, the seven calendar-day timeframe provides registrants sufficient time to act while also allowing DEA to promptly investigate potential diversion.

The proposed rule complements and expands upon both the Masters Decision and Order as well as the Masters D.C. Circuit ruling from 2017. However, as a result of Masters and the lack of DEA guidance, registrants have been making suspicious order reports for all ORUSCs, regardless of whether due diligence is conducted. DEA hopes that the emphasis on the second option will address those issues and provide the agency with a more accurate picture of diversion. In its preamble to the proposed rule, DEA states that it assume “20 percent of ORUSCs would be reported as suspicious orders and rejected, while the suspicion would be dispelled and order filled for 80 percent” of ORUSCs, thus limiting the number of over-reported ORUSCs.

DEA Centralized Database

DEA’s implementation of the PDDA included its establishment of a centralized database for collecting reports of suspicious orders, also known as the Suspicious Orders Report System (SORS). The database, which closely resembles the Automation of Reports and Consolidated Information Systems (ARCOS) and can be accessed using the same login information, was launched by DEA on October 23, 2019.

Recordkeeping

For recordkeeping purposes, DEA generally requires more than a “check-the-box” type of documentation and that continues to be the case in the new proposal related to managing ORUSCs. Under the proposed rule, a registrant’s records should include:  

• What information and circumstances rendered the order actually or potentially suspicious;

• What steps, if any, the registrant took to conduct due diligence;

• If the registrant conducted due diligence, what information it obtained during its investigation, and when the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and

• If the registrant distributed controlled substances pursuant to the order.

Conclusion

The two-option framework has been used by registrants for some time in response to the resolution in Masters, but DEA believes the reporting of suspicious orders after due diligence, versus reporting of all ORUSCs to the agency, has the potential to be more consistent and capture diversion in a meaningful manner.

The DEA registrant has always been responsible for identifying and reporting suspicious orders of controlled substances to DEA.  This form of reporting provides DEA investigators information regarding potential illegal activity in a more efficient manner than is otherwise possible for the investigators to do alone. However, DEA’s current regulations and heavy reliance on industry self-monitoring has been unsuccessful in detecting and preventing diversion, as recent litigation and settlements related to opioid diversion have demonstrated. Registrants have called for DEA to further clarify industry’s suspicious order obligations. With this proposed rule to implement the PDDA and explain the steps industry can take to identify and report suspicious orders (or to refuse to distribute them based on the outcome of the registrant’s diligence process), DEA is hoping to address the ongoing uncertainty of suspicious order reporting to combat the opioid epidemic. We expect significant comments to be submitted in response to the proposed rule and will report back on any changes made when the proposal is ultimately finalized by DEA.

[1] Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206 (D.C. Cir. 2017), available at: https://www.cadc.uscourts.gov/internet/opinions.nsf/D83B55CAB08AC6698525814F00517D77/$file/15-1335-1682127.pdf